f1b5de7c089c17d16327a06ef1938642cfca30bf57731398146bd2cb51304cd3

Analysis

max time kernel
70s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 08:16

Target

f1b5de7c089c17d16327a06ef1938642cfca30bf57731398146bd2cb51304cd3.exe
Size

1020KB
MD5

09c88ca00b3b11379958fb87ee0df81b
SHA1

9bd2dec0a142195ee8769ceaac0bfef659dd17c6
SHA256

f1b5de7c089c17d16327a06ef1938642cfca30bf57731398146bd2cb51304cd3
SHA512

6660b541daccb049ab17f99c0404cdd992cc4f5862dadbd1b6f7fcd06d9a9f111aba13f260e9df725c155817c7f5e56a184b50b3bb24f653065368c0ebf737fc
SSDEEP

24576:0Ob1IX3rcMjfI98exWnk6GEz7hpHh120uMSJczvfXug:0Ob6HNzIaMpedTp6

Score

8^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1960-55-0x0000000000400000-0x00000000006B7000-memory.dmp	vmprotect
behavioral1/memory/1960-58-0x0000000000400000-0x00000000006B7000-memory.dmp	vmprotect
behavioral1/memory/1960-60-0x0000000000400000-0x00000000006B7000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1960	f1b5de7c089c17d16327a06ef1938642cfca30bf57731398146bd2cb51304cd3.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
676	1960	WerFault.exe	16

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
464	Process not Found
464	Process not Found

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1960	f1b5de7c089c17d16327a06ef1938642cfca30bf57731398146bd2cb51304cd3.exe
1960	f1b5de7c089c17d16327a06ef1938642cfca30bf57731398146bd2cb51304cd3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 676	1960	f1b5de7c089c17d16327a06ef1938642cfca30bf57731398146bd2cb51304cd3.exe	28
PID 1960 wrote to memory of 676	1960	f1b5de7c089c17d16327a06ef1938642cfca30bf57731398146bd2cb51304cd3.exe	28
PID 1960 wrote to memory of 676	1960	f1b5de7c089c17d16327a06ef1938642cfca30bf57731398146bd2cb51304cd3.exe	28
PID 1960 wrote to memory of 676	1960	f1b5de7c089c17d16327a06ef1938642cfca30bf57731398146bd2cb51304cd3.exe	28

C:\Users\Admin\AppData\Local\Temp\f1b5de7c089c17d16327a06ef1938642cfca30bf57731398146bd2cb51304cd3.exe
"C:\Users\Admin\AppData\Local\Temp\f1b5de7c089c17d16327a06ef1938642cfca30bf57731398146bd2cb51304cd3.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 380
  2⤵
  - Program crash
  PID:676

memory/1960-54-0x00000000753D1000-0x00000000753D3000-memory.dmp

Filesize
8KB

Download
memory/1960-55-0x0000000000400000-0x00000000006B7000-memory.dmp

Filesize
2.7MB

Download
memory/1960-58-0x0000000000400000-0x00000000006B7000-memory.dmp

Filesize
2.7MB

Download
memory/1960-60-0x0000000000400000-0x00000000006B7000-memory.dmp

Filesize
2.7MB

Download